hxxp://kamtape[.]com/forgot

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
119s
max time network
121s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://kamtape.com/forgot
Sample260808-3s617awfle

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	firefox.exe
Token: SeDebugPrivilege	2788	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2788	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2788	2152	firefox.exe	80
PID 2152 wrote to memory of 2788	2152	firefox.exe	80
PID 2788 wrote to memory of 2076	2788	firefox.exe	81
PID 2788 wrote to memory of 2076	2788	firefox.exe	81
PID 2788 wrote to memory of 2076	2788	firefox.exe	81
PID 2788 wrote to memory of 3124	2788	firefox.exe	82
PID 2788 wrote to memory of 3124	2788	firefox.exe	82
PID 2788 wrote to memory of 3124	2788	firefox.exe	82
PID 2788 wrote to memory of 3124	2788	firefox.exe	82
PID 2788 wrote to memory of 4592	2788	firefox.exe	83
PID 2788 wrote to memory of 4592	2788	firefox.exe	83
PID 2788 wrote to memory of 4592	2788	firefox.exe	83
PID 2788 wrote to memory of 4592	2788	firefox.exe	83
PID 2788 wrote to memory of 3876	2788	firefox.exe	84
PID 2788 wrote to memory of 3876	2788	firefox.exe	84
PID 2788 wrote to memory of 3876	2788	firefox.exe	84
PID 2788 wrote to memory of 1008	2788	firefox.exe	85
PID 2788 wrote to memory of 1008	2788	firefox.exe	85
PID 2788 wrote to memory of 1008	2788	firefox.exe	85
PID 2788 wrote to memory of 1008	2788	firefox.exe	85
PID 2788 wrote to memory of 812	2788	firefox.exe	86
PID 2788 wrote to memory of 812	2788	firefox.exe	86
PID 2788 wrote to memory of 812	2788	firefox.exe	86
PID 2788 wrote to memory of 812	2788	firefox.exe	86
PID 2788 wrote to memory of 2004	2788	firefox.exe	87
PID 2788 wrote to memory of 2004	2788	firefox.exe	87
PID 2788 wrote to memory of 2004	2788	firefox.exe	87
PID 2788 wrote to memory of 2004	2788	firefox.exe	87
PID 2788 wrote to memory of 3176	2788	firefox.exe	88
PID 2788 wrote to memory of 3176	2788	firefox.exe	88
PID 2788 wrote to memory of 3176	2788	firefox.exe	88
PID 2788 wrote to memory of 3176	2788	firefox.exe	88
PID 2788 wrote to memory of 4268	2788	firefox.exe	89
PID 2788 wrote to memory of 4268	2788	firefox.exe	89
PID 2788 wrote to memory of 4268	2788	firefox.exe	89
PID 2788 wrote to memory of 4268	2788	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://kamtape.com/forgot"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://kamtape.com/forgot
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {86700c89-dcea-4589-9ff8-007b1b82dc02} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27133 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {4704f60f-1e84-4783-9de0-c0b6d78cde0b} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 25213 -prefMapHandle 3796 -prefMapSize 270279 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {0e3b4b2e-3832-4203-b907-bab6200eb888} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3984 -prefsLen 27323 -prefMapHandle 3988 -prefMapSize 270279 -ipcHandle 4056 -initialChannelId {a731ac4e-85ea-490e-a8bb-e9a5ecc96903} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2988 -prefsLen 34822 -prefMapHandle 2992 -prefMapSize 270279 -jsInitHandle 960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3284 -initialChannelId {45599357-4424-46ac-b105-ea9dffcf2e28} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5060 -prefsLen 34903 -prefMapHandle 5064 -prefMapSize 270279 -ipcHandle 5072 -initialChannelId {c496fa28-0edb-47b3-9c60-d3df5ca92a90} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32845 -prefMapHandle 5268 -prefMapSize 270279 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {522e2bbd-864f-47d7-bb48-cef0421f35df} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 32845 -prefMapHandle 5476 -prefMapSize 270279 -jsInitHandle 5480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5488 -initialChannelId {b72461b4-4331-4b40-8f03-7289d02158e0} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5712 -prefsLen 32845 -prefMapHandle 5708 -prefMapSize 270279 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5700 -initialChannelId {31f0fb45-fea6-42eb-902a-c7171e12d117} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 1aecced2d753ceeb3672748ea71f657bbc65a2d512d00bbf54abfae22ee39ed4
MD5 25911ae92c50b7cb145f702529bce014
SHA1 44604ecb999abd491e154e4588e56952dec6b5cd
SHA512 d44707b0edde1decb1a1f5a1b266d3590127803c82b332e1e7e7f14d3d8ef6630f21e3a2fb13a3d1fbe2a7188ea10c37a8cbef4c8d2312658c780cdb03a89f9d
SSDEEP 384:HwCe7iO024YvDL84KKDL849B7SOEAd9KVRaAcP+AWRMAd53:QqZYvDL8lKDL8CB7S/AmVAf+hRMk53
TLSH
T1E8729E7D9F413CAC1997C0E8C5F882DA4C18B6A7CFE6806D21683D0DC694A79B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 889429b85a578cc6b36db2fc48d26fa120c210295d9d705a688dda7126935aca
MD5 923a3e75fa3bf0697c3d843788120a5d
SHA1 c1dfb72d2d7a7eb87f00be454d488125604f44b9
SHA512 9ac110ec3ea801f3c1b5fd87e5845b391eafae40d8c0375af085d28e06890ecd4cc3214fe1a5227da0fb6281245d6ef7d279eaba1e4313f33d0cd53868d984a4
SSDEEP 384:HXkRyiO024YeDL84KKDL849B7SOEAd9KVRaAcP+AWRMASG:3mZYeDL8lKDL8CB7S/AmVAf+hRMs
TLSH
T1D7728E3D4F003CAC25A7C0ECC5B982AA4D18B7A7DFE6C06D25583D09CB98969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 6b24e2d12c791f565195e57a395d7f2aff860c443e3b991b0ada77627247f9c5
MD5 f42448b9b914bc9cd8ea90d76d8d752a
SHA1 093e2afdbe81327bf377f68e2fb564fc5baa0df3
SHA512 f381fc698fca0c482f9df31531f8da3a28e7a7600ca8a608c1cb3a77ec16ccbe87b5e9e98518fd554ace33c63ca73e76a3d8732e4df1d14880a813744d342306
SSDEEP 192:11d66Joz0dzgCl6mc0dSI07IaOv5zboIZhIKSyjoImI:zd66JozQzgC1jYzkboIZhVSyjoM
TLSH
T12ED1EC68E628863BC418023FDDA61B400F36389A984F7F69319C645D2D972DD7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 177feccfc03afb0baec973efb1c9b0ddad1cfb177e9a1e0c5703c6a37734f053
MD5 3bdf779c67cce3ac25e97d11dfcebe32
SHA1 58e5cd544c282a5902255aa1f26b3a7feac75bfb
SHA512 a6d9d20efddabececc118df8cfd1d144e3eefe5e4511fe6d4230c7fcee11f9a70a109e7bcdcedc3946d5aa41589d07d25f0483def61bf94b75f862b6f2b76307
SSDEEP 192:QI07IaOv5zboHIZhIKSyjoI03Pp1d66Joz0dzgCl6mc0dz:QzkbooZhVSyjodPd66JozQzgC1jd
TLSH
T1F4E11DA4EA28863BC408037BDCA61F410F36389A9C4E7F19359D641C2D572DD7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 56KB
SHA256 70fe98049a8d8403bc0c9ce80dfb27c2208838fec83f7fb3baf5ef55ac6a7a30
MD5 4a97e932ca6811fd9ca529a280d93de3
SHA1 4e24630008e73f3aabe429298bb31510fb879abe
SHA512 b9d9240319493451bdd86ea2d9dbcf32337c8f8438afad295c334eb1a2ab9c1795e4816cd0fbf4f5fb36d759dd1625a0edde9f02eb37550a41d653d1d1e65efa
SSDEEP 1536:q/R0cSMiQV/lDLiLxoVfTKczzr2RwBUpXg7rNC/+R:q/RfNpV9DQGpHWqBwwFC/S
TLSH
T13D431144EB1A553FD82802BA9DD21B003F78F8895A1A2F6B375C64786C873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 56KB
SHA256 094392aa4632f7e8852e3e53d6b0bc2d3e2f492ba4a158ad4f8c22dcf92689b7
MD5 6a91a53352350a9b569d62d46924ce72
SHA1 d927c36543380bfdd0439bb6f80dfc1c8bb1fd05
SHA512 18836541b5ff14abf048160e1f623a60744bc78933a47267727a8cbe6e9e1174584d900cf0a8e9dee2b28bcf9e2a9d158f2737e7e4f926930b6281947e3c84d1
SSDEEP 1536:S/R0cSMiQV/lDLiLxoVfTKczzr2RwBUpXg7rNC/+j:S/RfNpV9DQGpHWqBwwFC/a
TLSH
T1EC431144EB1A553FD82802BA9DD21B003F38F8895A1A2F6B375C64786C873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 56KB
SHA256 3d64fc5c9398f96addce469056f984e9b632491536cd8d19df6ca18517d2a4c1
MD5 8cafc53336afc2d7f42be2093895d4f9
SHA1 9217139e4689c11671b364b3d651f8ddf6f7e3cb
SHA512 6cb43626fc2f2986dae0c3dcd1e4c74f8f6f7aa7fe43e030476b99a53b1fd97b32442ba9a20aee8be187381ae6104badf76a7c9a654295ddaf00e337a68d23d5
SSDEEP 1536:K/R0cSMiQV/lDLiLxoVfTKczzr2RwBUpXg7rNC/+R:K/RfNpV9DQGpHWqBwwFC/S
TLSH
T17B431144EB1A553FD82802BA9DD21B003F38F8895A1A2F6B375C64786C873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\events\events
Size 1KB
SHA256 eefc00a5282ef0a5bc4ee06419930f2e749724f5928474ebd15382c556165015
MD5 0beac537e361ca20eeede7bea61e8770
SHA1 57e00233d15593e746a99f379cd6b2e4dd7b46ab
SHA512 1aa4c0227b96f0030389e61543a94aab396b74c073a7c7dd18e2f99f224e44bc2c8cc1b5d329d58c7165cfe2a69e533beaa26b88531bf43cfd4da73f0141b29b
TLSH
T13821675C3AF98D3A98C7E29C7442038E53558A4B44871D8B4E13EF8DDE92AD9326A43D
MD5 SHA1 SHA512 TLSH

Submit Download

0c6c8413-aa3d-4719-8ca4-0cc688a5dca0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\0c6c8413-aa3d-4719-8ca4-0cc688a5dca0
Size 235B
SHA256 96db8c8e5f40e1eb91d4f2f9ec600103a5459e7fd44c8714118fcd95b126c37c
MD5 2db0edcb65ac16247af03b4f703a70c5
SHA1 de84593437f030ae8e68fdc5736cf9a7f53355bb
SHA512 f84c761b74013fd6aa3803123068228024469958fc085a155ca60f77d3fc318a6a33575231e4f7f7e2451d17e4470ec533305416b79948cb4cbc898b12419082
TLSH
T16DD0A79124AC7B9D48180F56F0E169CA75445C3724B8A820DA9545749AB9EC592B1C17
MD5 SHA1 SHA512 TLSH

Submit Download

26fb990e-f32b-42ac-9372-99ba111408be

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\26fb990e-f32b-42ac-9372-99ba111408be
Size 2KB
SHA256 03ce8e5a03a0cfe54618e66b3d5c6861a67278f6fdd06546740d7342c20cbc02
MD5 c9646d8694af9d13e30576eb413bd790
SHA1 e2ab87daa9ee1b8d2105e7a16983412b1f3ffb8b
SHA512 348af36db930f90ce1420f2a466ca66fbcf18a69ec6ae71c7a422370b313897221d965b2152e966bc6ecc18843656243bb0413926fed2b92cd4722dc42e40976
TLSH
T1D141565C357C9CB79CABF19DD482234E53609A0300C65C936F52DF0C8C9569A736A13B
MD5 SHA1 SHA512 TLSH

Submit Download

27872bb7-e231-413f-9cb0-187c8ca755b2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\27872bb7-e231-413f-9cb0-187c8ca755b2
Size 883B
SHA256 3f1ba9383b4583a4df7292dac34449ef17e53052f99dfe6ee2a3b588eabdcc4d
MD5 5875fd7a7808b716bda56b09f718331c
SHA1 720d7e9202b61fa1cdd02eb2011a0559fb5a1189
SHA512 5befbb0a0856d526b854ed88f80d10e9b5889130cc289b9ae65ee203a6c3367b3bfab52c5939bc3b55d143c473c8550e5b8cbabb8341f3ad389f1865c445886d
TLSH
T10D1127C09538B573DC28D24FC692370247E4762380C654143DB55E184D7E96F636771B
MD5 SHA1 SHA512 TLSH

Submit Download

50b8f6f3-9b3e-4662-97af-ff0cfbd6c044

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\50b8f6f3-9b3e-4662-97af-ff0cfbd6c044
Size 2KB
SHA256 5a00d9dff74d606d971ed502c20ce490a1ffc276c2f9db1abec318b278b36e4e
MD5 8684ed13d79d78f4eb16033da7a2a184
SHA1 18b2491c4e324649d52c3a8fdce62f7930b0ddb6
SHA512 55c845a9e82cd9ab4d7d727c2a55e3de29130bb905b099317fe5b541d889f780fcd54426424daa7b36a23aa8e00082bd2c0d72643add5aa4a340c2e3b68bdece
TLSH
T17551B9694164D87EC879B30ED9213B82CBF3140B408B1D4EAEECAF0B157FD5E5359605
MD5 SHA1 SHA512 TLSH

Submit Download

c828f845-9509-464c-b4a1-c44b01758777

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\c828f845-9509-464c-b4a1-c44b01758777
Size 886B
SHA256 d8c0c1b92f25d9a0326660f3448ec7dee6bf9f43b2a8cfce46d81f312644fad0
MD5 54bb8a188431b95020718393959e5555
SHA1 077717ea7ea035169bcfdcd86e28e0cf35c5eda7
SHA512 edf236b1688ffb31e7609ef54d80d2ccaa655a8c21e7b50ae2f4a42b715fb8f967691c2f3fef36f38baf62f3c93dbe1dee80d0143a940327df7b22d4e5e89d8f
TLSH
T1171123C0853879B2CD38D29F95F13B4287A0752380C64D583E568F180DED67E636B307
MD5 SHA1 SHA512 TLSH

Submit Download

cd55f469-e1d4-4591-88c6-669f50b385a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\cd55f469-e1d4-4591-88c6-669f50b385a9
Size 235B
SHA256 66ad5ccaa88121566a938c5226b1a93252b37ff4baf440db808f3df2eddbf12f
MD5 c302517296346a5b9ef6b66acd5fb423
SHA1 d99a734ea8aafdd69394058f8905aa651163e176
SHA512 a9c8440b2bb1646fe28dda4f47fdac2f4e35631bf15468151fcd07c1c55c2c699a6aae05646a9765664a1a3cba7c0ee6bc41768e20441933e9a72b6e4a4b252c
TLSH
T196D097822498236D08048F86B0E0ACC230894C3368645820EAA28174EAFDDC802A280B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\extensions.json
Size 16KB
SHA256 f2ba8a52de2fdc1b06722e72b8adf87bf913ea2f14e6f18a2d6bced1f6167564
MD5 33776ae05fa59572a0583e91d40130af
SHA1 961d1848c5e25a7f8ac9c9024dc735e62fccfb55
SHA512 42de4adad3e0a6ed29a5eba492a058910130a3f5ade7a6454a5df7b4ef1644b69ea45c9f062aaa595b0171994f2e7f7e146318e59bfe818fe5bb28c863c1d738
SSDEEP 384:YkI4vIUmldv68dhWR94zX896oKL4HUL4Pw5L4H3L4HRL4H0h4hI:PI4ARf/Xo4M6f4u4ox4b4p4w4m
TLSH
T11972521545049EB8298FA79AAA367E01C37D433B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs-1.js
Size 6KB
SHA256 12c37a84951bd0f80069d7fe58f8eb1551c7ea2ecaad1926f493459152f1d27d
MD5 10c6298638b7d459bfc83c47bb16d323
SHA1 b8c1c5460bff6d063a250c84ef9b466cd4320828
SHA512 f1bdd595bf0939fe622bb42910009a21b328fb35afce00a68632d40d968909131df2d24e9dc8eb5295459461d3c9a89eab111fdf4412bc8951919b30e6354139
SSDEEP 96:xH/UTULXqGqSfwuF1zSSSSl+dv9jyLgnRERHPKLy4Bw88H8L4cnEiIym:hb6RSfwuFfSS/z9PuBw888I5
TLSH
T1F9E1307894088F7F74B6776CAC6889315AB2013BBBBF68C710B94485055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs-1.js
Size 7KB
SHA256 11c3125c7a42bdb80b0f33c1c9b76c71aa782143929ad617131f319090738f5f
MD5 e5c4a0406dac76d706907b5ee7c454c3
SHA1 f8cfce409c48b677f634886fae6a0ac74a145723
SHA512 274f5846b640ad08e3ab8cdedcdb228fbf101595f9cb050bacb15971226d31285f3c7d4b690d79cee3e706b4ead698e8ab7eab7230ec8f61c300487ad528a078
SSDEEP 96:xH/JTULXqGqSfM6VuFObzSSSSl+dv9j3fnRERWR8W2jKLyEBw88AQGz68L4cnEOA:hS6RSfM6VuFoSS78RHW2Bw88AQGzlI5
TLSH
T19FF11E789048CF7F74B6766CAC2989315AB2023BB6BF6CC711B94485154CF3841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs.js
Size 6KB
SHA256 e2f24715d319568f90e0459aae49f2fedb6b7675e375c8e908738b3947deed18
MD5 2c23ad9d9167c9581bc57972f5107fae
SHA1 74e3d677af56449040ae1470fedab58af4803431
SHA512 9571d3b24c09060f6ba2bf07c59c3fb83e4974e139850207844089482afb1b6be55007275b5b3240b26bfd591ae22c7036001f7e95c4c69eeb199a6e8a4c9788
SSDEEP 96:xH/UTULXqGqSfwpmk1zSBYSSl+dv9jyLgnRERHPKLy4Bw88H8L4cnEiIym:hb6RSfwpmkAYSS/z9PuBw888I5
TLSH
T14DE12F7894088F7F74B6776CAC6888316AB2413B7BBF68C710B95485055CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs.js
Size 7KB
SHA256 85aaffbc1545a272a1222066e9ea576c0254d75077996d2412929924608ccbde
MD5 b350f12943f4fc0a287f896559d62f84
SHA1 d5d3b09af67f89a75b5c5ea9710f8bccc299d245
SHA512 7aaae8e1815c5c31f2b66e23371cf3bf6e5c7287a48ce4c2f728fab84a14128c3d917d31150c312fe38e9908209c51ccfb7af61007710d43a60b7b18e04d5fad
SSDEEP 96:xH/JTULXqGqSfwuFObzSSSSl+dv9j3fnRERHPKLy4Bw88AQz68L4cnEiIym:hS6RSfwuFoSS79PuBw88AQzlI5
TLSH
T195F12F789008CF7F74B6766CAC6848315AB2013BB6BF68C710B944C5155CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 253fd4fb3990e36435226dd784aa8169439ea4c3c5f0affcbf81eb7e52910cc4
MD5 5893beda69d9d66d03a3a54c5f40ae0c
SHA1 5f543d4631894e3fb0b10d0e0840cf3c2b45d8e0
SHA512 0f79a8535e4aa60cc75c1128a8a1e724a376adef35393aca16fa88b56bf1bb6e4725c9fbc2311cbcb0d889e9ca28fff9fae92f1567e4b56d8171adad8fa524b7
TLSH
T1D0515C87ED611BAE1B22A54F9046ABBEEBE0343948F450F4854449051789A03F34D325
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 9d6d2adbfad4abb5ea49ab4ff096359ffe26acec6299e13b25894c082a2e59f8
MD5 4b6c5378ed5216c790ce3343ee2d2a26
SHA1 43190c382c6d645b962f5e3f4548d2f39566b4da
SHA512 81ddb1f95646c67281ac83c3c33125619f99a3548ad1d82a932e5d51ebc8404fa576480a9feca35657926f6632e587f88bdf503831c46f63c36bbcd51710e650
TLSH
T12C515C87ED611BAE1721E60E90427FBEEBE0343A84F460F4894489151786603B34D325
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 8ccb50c3a7f1da203ac475ded506330c893e20273521ffce09b19d99dfc6a757
MD5 8604ed62e506074ac7de829486ee11e6
SHA1 97603e7ff935412fa60671e49ee22cc308f89439
SHA512 06f7f36f2347efa84f7a4f22aa0129196dd14e6d5989dea8997930fd7ca998cf7dc7c383b3b716544d6c6407784c347c23c01687f5594f5209874926002c55d1
TLSH
T1AC515D87EEA42BAB8729A15F64597F7BFFA0313E88E820A148040E0553CA713F716319
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 06c62751761ce4fe3e7c8fdd30e6cbad99d185f61daf5630fbb99a2dfec9a858
MD5 37d1e45280635ebb573e237468e44ffe
SHA1 f625ac493e9b9bd5fa5b42974e4504068cd7dd0e
SHA512 571fc103dbbb73b6a4d5ea2313fb77aa0a471c684339b7f88db162e2e4948b2ade44a1ec1ee59714054f664887096998ec08c39ae4a657b791fafea1e178a7cf
SSDEEP 49152:ULRLyBaeULdmfJ9MeHyREg6QC5zYYoy8lhm0K0JkwkxO/MQpaQ/7FAU427TYh4Z0:iBTAb4E2TmunQCwHJF/x
TLSH
T132667DE460E29252F34244B3719953EB10EFC00C6077CE44579496FAA9B8CEB8E97B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads